You can control Android devices for compliance with corporate security requirements. Corporate security requirements regulate how the user can work with the device. For example, the real-time protection must be enabled on the device, the anti-malware databases must be up-to-date, and the device password must be sufficiently strong. Compliance Control is based on a list of rules. A compliance rule includes the following components:
If the device is in battery saver mode, Kaspersky Endpoint Security for Android may perform this task later than specified.
To create a rule for checking devices for compliance with a policy:
The Compliance Control window opens.
If the check box is cleared, the user is not notified of the non-compliance issue, and the response is performed on the device as soon as the time allocated for fixing the non-compliance expires.
The Add rule wizard starts. This wizard will help you create a set of rules for checking the device compliance with the policy. Navigate through the wizard using the Next and Back buttons.
Step 1. Criterion for non-compliance
Click Add criterion to specify the non-compliance criterion to trigger the rule.
The following criteria are available:
Kaspersky Endpoint Security for Android is not installed or running on the device.
Anti-malware databases were last updated 3 or more days ago.
The list of apps on the device contains apps that are set as forbidden in the App Control settings of the policy.
The list of apps on the device contains apps from the categories that are set as forbidden in the App Control settings of the policy.
The list of apps on the device does not contain an app that is set as required in the App Control settings of the policy.
The Android version on the device is outside the allowed range.
For this criterion, specify the minimum and maximum allowed versions of Android in the Minimum version and Maximum version fields. If the maximum allowed version is set to Any, future Android versions supported by Kaspersky Endpoint Security for Android will also be allowed.
The last synchronization of the device with the Administration Server is checked.
For this criterion, specify the maximum period after the last synchronization in the Period without synchronization field.
The device is hacked (root access is gained on the device).
The unlock password on the device is not compliant with the settings defined in the Screen unlock settings card.
Kaspersky Endpoint Security for Android installed on the device is obsolete.
This criterion applies only to an app installed using a Kaspersky Endpoint Security for Android installation package and if the minimum allowed version of Kaspersky Endpoint Security for Android is specified in the App update settings of the policy.
The device SIM card has been replaced or removed compared to the previous check state, or an additional SIM card has been inserted.
For this criterion, select the specific condition that must be monitored:
The device is outside the specified geofence areas.
Specifying the geofence area will result in increased device power consumption.
For this criterion, select the specific condition that must be monitored:
To add a geofence area:
The Add geofences window opens.
For each geofence area, you can manually enter from 3 to 100 coordinate pairs (latitude, longitude) as decimal numbers.
A geofence perimeter must not contain intersecting lines.
If needed, you can specify more than 3 points by clicking the Add point button.
To delete a point, click the X button.
You can view the specified geofence area in the Yandex.Maps program by clicking View on map.
Kaspersky Endpoint Security for Android is not allowed to access the precise location of the device or use the device location in the background.
Step 2. Responses for non-compliance with security requirements
Add the responses to be performed on the device if the specified non-compliance criterion is detected.
Choose one of the following options:
The following responses are available:
All apps on the device, except system apps, are blocked from starting.
As soon as the non-compliance criterion selected for the rule is no longer detected on the device, the apps are automatically unblocked.
The mobile device is locked. To obtain access to data, you must unlock the device by entering the one-time passcode or using the Unlock device command.
The corporate data is wiped from the device. The list of wiped data depends on the mode in which the device operates:
All data is wiped from the device and settings are rolled back to their factory values. After this response is performed, the device will no longer be managed. To connect the device to Kaspersky Security Center, you must reinstall Kaspersky Endpoint Security for Android.
On devices running Android 14 or later, this response is only applicable if the device is operating in corporate device mode.
Corporate container on the device is locked. To obtain access to corporate container, you must unlock it.
The response is only applicable to devices running Android 6 or later.
After the corporate container on a device is locked, the history of the container passwords is cleared. It means that the user can specify one of the recent passwords, regardless of the corporate container password settings.
On a corporate device, data of all apps on the device is wiped.
On a device with corporate container, data of all apps in the container is wiped.
As a result, apps are rolled back to their default state.
The response is only applicable to devices running Android 9 or later in corporate device or device with corporate container operating modes.
For this response, you need to specify the package name for the app whose data is to be wiped. How to get the package name of an app
As a result, the app is rolled back to its default state.
The response is only applicable to devices running Android 9 or later in corporate device or device with corporate container operating modes.
The user is not allowed to boot the device in safe mode.
The response is only applicable to corporate devices running Android 6 or later.
The user is not allowed to use any cameras on the device.
The user is not allowed to turn on and configure Bluetooth settings.
The response is only applicable to personal devices running Android 12 or earlier, corporate devices, or devices with corporate container.
The user is not allowed to use and configure Wi-Fi settings.
The response is only applicable to personal devices running Android 9 or earlier or corporate devices.
The user is not allowed to use USB debugging features and developer mode on the device.
The response is only applicable to corporate devices or devices with corporate container.
The user is not allowed to enable airplane mode on the device.
The response is only applicable to corporate devices running Android 9 or later.
Click Add rule to finish the Add rule wizard. The new rule and its details appear in the list of the Compliance Control rules. To temporarily disable a rule, use the toggle switch next to the selected rule.
To enable the automatic wiping of data from devices associated with disabled accounts of Active Directory users, select the Wipe data from devices with disabled Active Directory user accounts check box and select one of the following actions:
On devices running Android 14 or later, this action is only applicable if the device is operating in corporate device mode.
These settings require integration with Microsoft Active Directory.
If you use policy profiles, be sure to enable the wipe data option for the entire policy. When a user account is disabled in Active Directory, it is first removed from the Active Directory user group. As a result, the policy profile is no longer applied to this user account, so the data is not wiped from the device.
Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.
Page top